Check dependencies against CISA's real Known Exploited Vulnerabilities feed.
Scored across 1 tool
There is only one tool, so there is no possibility of misselection or overlap. Its purpose (checking names against the CISA KEV catalog) is unambiguous.
The single name 'check_kev' is a clear, readable verb_noun-style name. With only one tool there is no pattern to verify against, so it cannot be judged fully consistent.
The server's scope is narrow and single-purpose (one live lookup against the KEV feed), so a single tool largely earns its place. It is slightly thin — one more operation would round out the surface — but not mismatched to the scope.
Name-to-KEV lookup is covered, including comma-separated batch input, but there is no reverse lookup by CVE ID and no way to browse or list catalog entries. These are notable gaps for triage workflows, though agents can work around them.
Check a comma-separated list of software dependency/product names (e.g. 'lodash, openssl, apache struts') against CISA's real, public Known Exploited Vulnerabilities (KEV) catalog. Returns any current matches with the CVE ID, description, date added, and known ransomware use -- grounded in CISA's live feed, not a guess. Useful for triaging whether a project's dependencies include anything under active exploitation right now.
| Name | Required | Description | Default |
|---|---|---|---|
| dependencies | Yes | Comma-separated dependency/product names, e.g. 'express, lodash, openssl' |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that the result comes from CISA's live public feed rather than a guess, and enumerates the returned fields (CVE ID, description, date added, ransomware use). It does not mention rate limits, auth needs, or failure behavior, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences are front-loaded and purposeful: purpose, return fields with data-source provenance, then use case. Slightly verbose but each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, annotation-free tool with no output schema, the description covers purpose, input format, return fields, and provenance, which is nearly everything an agent needs. Minor omissions (matching behavior for partial names, error handling) keep it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the single parameter is already fully documented with the same comma-separated example. The description reinforces the format ('lodash, openssl, apache struts') but adds no syntax or matching-semantics detail beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (check), resource (comma-separated dependency/product names), and authoritative data source (CISA's live KEV catalog). An agent can immediately tell what this does and what it is grounded in.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a concrete usage context: triaging whether a project's dependencies are under active exploitation right now. There are no sibling tools to differentiate from, so the absence of explicit alternatives is not a real gap, but there is no explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
check_kevQuery OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
